2 * @file p448/f_generic.c
6 * Copyright (c) 2015-2016 Cryptography Research, Inc. \n
7 * Released under the MIT License. See LICENSE.txt for license information.
9 * @brief Generic arithmetic which has to be compiled per field.
11 * @warning This file was automatically generated in Python.
12 * Please do not edit it.
16 static const gf MODULUS = {FIELD_LITERAL(
17 0xffffffffffffff, 0xffffffffffffff, 0xffffffffffffff, 0xffffffffffffff, 0xfffffffffffffe, 0xffffffffffffff, 0xffffffffffffff, 0xffffffffffffff
20 /** Serialize to wire format. */
21 void gf_serialize (uint8_t serial[SER_BYTES], const gf x, int with_hibit) {
24 gf_strong_reduce(red);
25 if (!with_hibit) { assert(gf_hibit(red) == 0); }
27 unsigned int j=0, fill=0;
29 UNROLL for (unsigned int i=0; i<(with_hibit ? X_SER_BYTES : SER_BYTES); i++) {
30 if (fill < 8 && j < NLIMBS) {
31 buffer |= ((dword_t)red->limb[LIMBPERM(j)]) << fill;
32 fill += LIMB_PLACE_VALUE(LIMBPERM(j));
41 /** Return high bit of x = low bit of 2x mod p */
42 mask_t gf_hibit(const gf x) {
46 return -(y->limb[0]&1);
49 /** Return high bit of x = low bit of 2x mod p */
50 mask_t gf_lobit(const gf x) {
54 return -(y->limb[0]&1);
57 /** Deserialize from wire format; return -1 on success and 0 on failure. */
58 mask_t gf_deserialize (gf x, const uint8_t serial[SER_BYTES], int with_hibit, uint8_t hi_nmask) {
59 unsigned int j=0, fill=0;
62 const unsigned nbytes = with_hibit ? X_SER_BYTES : SER_BYTES;
63 UNROLL for (unsigned int i=0; i<NLIMBS; i++) {
64 UNROLL while (fill < LIMB_PLACE_VALUE(LIMBPERM(i)) && j < nbytes) {
65 uint8_t sj = serial[j];
66 if (j==nbytes-1) sj &= ~hi_nmask;
67 buffer |= ((dword_t)sj) << fill;
71 x->limb[LIMBPERM(i)] = (i<NLIMBS-1) ? buffer & LIMB_MASK(LIMBPERM(i)) : buffer;
72 fill -= LIMB_PLACE_VALUE(LIMBPERM(i));
73 buffer >>= LIMB_PLACE_VALUE(LIMBPERM(i));
74 scarry = (scarry + x->limb[LIMBPERM(i)] - MODULUS->limb[LIMBPERM(i)]) >> (8*sizeof(word_t));
76 mask_t succ = with_hibit ? -(mask_t)1 : ~gf_hibit(x);
77 return succ & word_is_zero(buffer) & ~word_is_zero(scarry);
80 /** Reduce to canonical form. */
81 void gf_strong_reduce (gf a) {
82 /* first, clear high */
83 gf_weak_reduce(a); /* Determined to have negligible perf impact. */
85 /* now the total is less than 2p */
87 /* compute total_value - p. No need to reduce mod p. */
89 for (unsigned int i=0; i<NLIMBS; i++) {
90 scarry = scarry + a->limb[LIMBPERM(i)] - MODULUS->limb[LIMBPERM(i)];
91 a->limb[LIMBPERM(i)] = scarry & LIMB_MASK(LIMBPERM(i));
92 scarry >>= LIMB_PLACE_VALUE(LIMBPERM(i));
95 /* uncommon case: it was >= p, so now scarry = 0 and this = x
96 * common case: it was < p, so now scarry = -1 and this = x - p + 2^255
97 * so let's add back in p. will carry back off the top for 2^255.
99 assert(word_is_zero(scarry) | word_is_zero(scarry+1));
101 word_t scarry_0 = scarry;
105 for (unsigned int i=0; i<NLIMBS; i++) {
106 carry = carry + a->limb[LIMBPERM(i)] + (scarry_0 & MODULUS->limb[LIMBPERM(i)]);
107 a->limb[LIMBPERM(i)] = carry & LIMB_MASK(LIMBPERM(i));
108 carry >>= LIMB_PLACE_VALUE(LIMBPERM(i));
111 assert(word_is_zero(carry + scarry_0));
114 /** Subtract two gf elements d=a-b */
115 void gf_sub (gf d, const gf a, const gf b) {
116 gf_sub_RAW ( d, a, b );
118 gf_weak_reduce ( d );
121 /** Add two field elements d = a+b */
122 void gf_add (gf d, const gf a, const gf b) {
123 gf_add_RAW ( d, a, b );
124 gf_weak_reduce ( d );
128 mask_t gf_eq(const gf a, const gf b) {
133 for (unsigned int i=0; i<NLIMBS; i++) {
134 ret |= c->limb[LIMBPERM(i)];
137 return word_is_zero(ret);